Privacy breaches

Privacy breach laws in New Zealand

New Zealand values the protection of individual privacy, acknowledging the Universal Declaration of Human Rights(https://en.wikipedia.org/wiki/Universal_Declaration_of_Human_Rights) and the International Covenant on Civil and Political Rights(https://en.wikipedia.org/wiki/International_Covenant_on_Civil_and_Political_Rights).

Digital data submission has become more common, and we often provide it without a second thought. Two critical laws come into play when privacy is breached: the Privacy Act and the Harmful Digital Communications Act (HDCA).

The Privacy Act and the Office of the Privacy Commissioner

The Privacy Act controls how 'agencies' manage personal information through 13 Privacy Principles.

Updated in December 2020, the Act ensures better protection and reflects modern information collection and storage methods. Notably, it does not cover personal information used solely for personal or domestic affairs unless it would be highly offensive to a reasonable person.

The Act grants greater protection for individuals and introduces new obligations for businesses, including mandatory reporting of serious breaches and increased fines for non-compliance.

Anyone can be an "agency" under the Act: “agency means any person or body of persons, whether corporate or non-corporate, and whether in the public sector or the private sector.”

If you suspect an agency is mishandling your information, you can request the Privacy Commissioner to determine if there has been an "interference with privacy."

The Office of the Privacy Commissioner (OPC)(https://www.privacy.org.nz/) is an independent Crown Entity responsible for investigating privacy complaints. If an agency has violated any of the privacy principles and is unwilling to resolve the issue, the OPC can provide guidance. The OPC may take action on your behalf through the Human Rights Commission, which can offer various settlements, including awarding damages up to $200,000.

The Harmful Digital Communications Act and Netsafe

The Harmful Digital Communications Act (HDCA)(/our-work/helpline-services/the-harmful-digital-communications-act), addresses harmful digital communications.

It outlines 10 communication principles, with two specifically related to privacy​ breaches​:

• Communication Principle 1: A digital communication should not disclose sensitive personal facts about an individual.
• Communication Principle 7: A digital communication should not contain a matter that is published in breach of confidence.

Netsafe helps resolve complaints related to these principles. Whilst not an enforcement agency, Netsafe has a high-resolution rate with resolving reports.

If someone shares information you consider to be personal and sensitive, such as medical information or intimate content (referred to as image-based abuse(/online-abuse-and-harassment/image-based-abuse)), this could be a ​privacy breach and ​violation of these Principles.

What happens to my data in a privacy breach?

It is not uncommon for legitimate organisations to have their data compromised, and when this happens it might mean your data has been affected.

Sometimes the data may be made available for purchase and download on the Dark Web. Criminals may use the information from these data breaches to try to access your accounts or create new accounts in your name.

Learn more about data breaches.(/online-safety-at-home/data-breach)

Steps to take if you've had a privacy breach

1. Collect evidence such as screenshots and URLs, noting the dates they were captured. Follow our advice for recording digital evidence here.(/online-abuse-and-harassment/how-to-record-digital-evidence)
2. Contact the agency and discuss the issue directly with them. If the agency is a company or government department, reach out to their Privacy Officer.
3. Report to the platform. For photos or videos shared without consent on social media, report them directly to the platform or online content host.
4. Use the identity theft checklist from the Department of Internal Affairs (https://www.dia.govt.nz/diawebsite.nsf/Files/EOI/%24file/identity_theft_checklist_pdf-a.pdf)to find or to read helpful guidance on what could happen to your information.
5. Contact iDCare(https://www.idcare.org/) on 0800 121 068 for free support as they are skilled at helping people in New Zealand who believe their details could be compromised
6. Report this incident to your bank as soon as possible so they can advise you on what you need to do
7. Undertake a credit check(https://www.govt.nz/browse/consumer-rights-and-complaints/debt-and-credit-records/check-your-own-credit-report/) to see if there has been any suspicious activity or accounts opened in your name
8. Change any passwords on accounts(/online-safety-at-home/how-to-choose-a-good-password) that have been breached and do not use the same password across multiple accounts to protect yourself from further data breaches.
9. Contact the Office of the Privacy Commissioner(https://www.privacy.org.nz/) or Netsafe, depending on how your information was shared.

If you suspect your privacy has been breached, remain alert to any emails or calls asking for anything suspicious like your passwords or to verify account details.

Legitimate organisations will never ask for passwords to your online accounts without your contacting them first.

You can contact Netsafe seven days a week for free, confidential and non-judgmental advice about an online issue impacting you or someone you know.

Report online (https://report.netsafe.org.nz/hc/en-au/requests/new)Email [email protected] (mailto:[email protected])Text 'Netsafe' to 4282 (sms:4282?body=Netsafe)Live chat support Call 0508 638 723 8am-8pm weekdays, 9am-5pm weekends (tel:0508638723)

How can I find out if my data has been used anywhere?

You may want to visit Have I been Pwned?(https://haveibeenpwned.com/) to see if your details are there.

Several large/public data breaches have been added so the site acts like a repository of data breaches and lets you check to see if your account has been comprised.

Netsafe is not affiliated with this website, and has not verified the data contained there.